AJAX security

When to use this skill

Use this skill whenever code registers or handles an AJAX action through WordPress's admin-ajax.php endpoint:

• add_action( 'wp_ajax_{action}', ... ) for logged-in users.
• add_action( 'wp_ajax_nopriv_{action}', ... ) for logged-out visitors.
• JavaScript posting to admin_url( 'admin-ajax.php' ) with jQuery, fetch, or wp.apiFetch.
• Returning JSON, HTML fragments, or any server-computed data from an AJAX handler.

If the request changes state or exposes privileged data, it needs a nonce and a capability check. wp_ajax_nopriv_* is intentionally unauthenticated — never use it for admin actions.

Related: see the nonces-csrf-protection skill for the full nonce lifecycle and the rest-api-security skill for REST endpoints.